Spyware Problem
<div class="IPBDescription">Or: "You got h4xed"</div> Spyware. The bane of internet browsers existence, myself being no exception. Today, while checking a list of know spyware against programs on my computer, I came across these 3 interesting pieces: "Shopping Wizard", "Search Extender", and "Home Search Assistant". First things first, I didn't install these programs, so don't even bother there. Second, it keeps changing my homepage from Planet Half-Life to... oh hell I don't even know. Obviously, I want this to stop.
I went to uninstall the the programs (using Add/Remove software in the control pannel), but kept getting this error message:
-------------------------------------------------------------------------------
|Error with Shortcut [X]|
-------------------------------------------------------------------------------
| |
| Unable to open "http://looking-for.cc/unistall/ShoppingWizard.html"|
| |
| |
|_______________________[Okay]____________________________|
I get the same message for every one, with an obvious difference for each (replace ShoppingWizard.html with SearchExtender.html or HomeSearchAssistant.html)
All the spyware remover programs I've used don't do anything to them.
Anybody know what to do?
I went to uninstall the the programs (using Add/Remove software in the control pannel), but kept getting this error message:
-------------------------------------------------------------------------------
|Error with Shortcut [X]|
-------------------------------------------------------------------------------
| |
| Unable to open "http://looking-for.cc/unistall/ShoppingWizard.html"|
| |
| |
|_______________________[Okay]____________________________|
I get the same message for every one, with an obvious difference for each (replace ShoppingWizard.html with SearchExtender.html or HomeSearchAssistant.html)
All the spyware remover programs I've used don't do anything to them.
Anybody know what to do?
Comments
A) Stop mentioned processes from running
B) Search Program Files for their folder, and delete them. If they're not there, check in Common Programs or whatever it's called. Usually they hide there.
Don't even bother touching the registry. As long as said spyware can at least read from the registry, there's a good chance that it will not infect your PC as easily.
Where do I go to do that?
Just go on run in the start menu and type msconfig, go to the end tab of startup and untick anything you dont think should be running.
Be warned though unticking the wrong things can cause more problems then to begin with.
The nice Windows Software Uninstallation wizard doesn' t like that though <!--emo&:p--><img src='http://www.unknownworlds.com/forums/html//emoticons/tounge.gif' border='0' style='vertical-align:middle' alt='tounge.gif' /><!--endemo-->
But to get rid of spyware, use these programs:
<a href='http://www.lavasoftusa.com/support/download/' target='_blank'>Ad-Aware SE (freeware)</a> = spyware removal tool
<a href='http://www.safer-networking.org/en/mirrors/index.html' target='_blank'>Spybot S&D (freeware)</a> = spyware removal tool/blocker
<a href='http://www.javacoolsoftware.com/spywareblaster.html' target='_blank'>Spywareblaster (freeware)</a> = Excellent spyware block tool.
<b>TAKE NOTE! DO NOT FORGET TO UPDATE THE TOOLS AFTER INSTALLATION!
</b>
Enjoy your spyware hunt >)
The nice Windows Software Uninstallation wizard doesn' t like that though <!--emo&:p--><img src='http://www.unknownworlds.com/forums/html//emoticons/tounge.gif' border='0' style='vertical-align:middle' alt='tounge.gif' /><!--endemo-->
But to get rid of spyware, use these programs:
<a href='http://www.lavasoftusa.com/support/download/' target='_blank'>Ad-Aware SE (freeware)</a> = spyware removal tool
<a href='http://www.safer-networking.org/en/mirrors/index.html' target='_blank'>Spybot S&D (freeware)</a> = spyware removal tool/blocker
<a href='http://www.javacoolsoftware.com/spywareblaster.html' target='_blank'>Spywareblaster (freeware)</a> = Excellent spyware block tool.
<b>TAKE NOTE! DO NOT FORGET TO UPDATE THE TOOLS AFTER INSTALLATION!
</b>
Enjoy your spyware hunt >) <!--QuoteEnd--> </td></tr></table><div class='postcolor'> <!--QuoteEEnd-->
Ahem...
<!--QuoteBegin--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td><b>QUOTE</b> </td></tr><tr><td id='QUOTE'><!--QuoteEBegin-->All the spyware remover programs I've used don't do anything to them.<!--QuoteEnd--></td></tr></table><div class='postcolor'><!--QuoteEEnd-->
I would still go by deleting them manually. Though it's hard to get it removed from the uninstall panel, I know where to go to remove Uninstall entries kekekeke
But that is top sekrat XD
You DID delete only the folders that are associated with the said spyware by name right?
In any case, reformats do wonders against them. Good luck getting the PC all together again <!--emo&:)--><img src='http://www.unknownworlds.com/forums/html//emoticons/smile-fix.gif' border='0' style='vertical-align:middle' alt='smile-fix.gif' /><!--endemo-->
(It's my fault....<!--emo&:(--><img src='http://www.unknownworlds.com/forums/html//emoticons/sad-fix.gif' border='0' style='vertical-align:middle' alt='sad-fix.gif' /><!--endemo-->)
<!--QuoteEnd--> </td></tr></table><div class='postcolor'> <!--QuoteEEnd-->
Have you tried <a href='http://www.spychecker.com/program/hijackthis.html' target='_blank'>HiJackThis</a> ? This is usually my last resort after ad-aware, spybot etc.
dialog boxes last night. I haven't used Internet Explorer for
an age so how it go on my system is beyond me.
Luckily Spybot S+D'd latest update managed to remove it for me.
After the scan I check my Internet Explorer security settings and
it had be knocked all the way down to none. Meaning pretty much
anything could through without any prompts. <!--emo&:(--><img src='http://www.unknownworlds.com/forums/html//emoticons/sad-fix.gif' border='0' style='vertical-align:middle' alt='sad-fix.gif' /><!--endemo-->
Furthermore, everytime a generic word like "computer" or "shopping" or "internet" etc. would come up on a internet page, it would be underlined in a strange way, and when I clicked on it, it would be a link to a page that sold that sort of thing. I tried everything.
I finally fixed the problem. The solution was so easy, I didn't even think about it. I formatted, reinstalled windows, and of course the problem was solved. I mean the obvious catch is that you have to go through that trouble, but it is a guaranteed solution to your problem.
Stop looking at pornography! (This helps too. <!--emo&:D--><img src='http://www.unknownworlds.com/forums/html//emoticons/biggrin-fix.gif' border='0' style='vertical-align:middle' alt='biggrin-fix.gif' /><!--endemo-->)
Download this instead: <a href='http://www.sysinternals.com/ntw2k/freeware/procexp.shtml' target='_blank'>process explorer</a>.
And YES IE became a little better after SP2, a LITTLE.
You DID delete only the folders that are associated with the said spyware by name right?
In any case, reformats do wonders against them. Good luck getting the PC all together again <!--emo&:)--><img src='http://www.unknownworlds.com/forums/html//emoticons/smile-fix.gif' border='0' style='vertical-align:middle' alt='smile-fix.gif' /><!--endemo-->
(It's my fault....<!--emo&:(--><img src='http://www.unknownworlds.com/forums/html//emoticons/sad-fix.gif' border='0' style='vertical-align:middle' alt='sad-fix.gif' /><!--endemo-->) <!--QuoteEnd--> </td></tr></table><div class='postcolor'> <!--QuoteEEnd-->
Actually I'm just gonna buy a new hard drive (250 GB Seagate). That should do it.
Reformat for the win, I guess.
[EDIT] Make sure your new HD is 7200 RPM or higher.